Why does DirectoryServicesCOMException occur querying Active Directory from a machine other than the web server?

Question

My ASP.NET WebForms app running on IIS 7.5 works fine when the request comes from the web server but throws the following error when the same domain user requests the same page from any other machine on the domain:

TYPE: System.DirectoryServices.AccountManagement.PrincipalOperationException

MSG: An operations error occurred.

at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInit() at System.DirectoryServices.AccountManagement.PrincipalContext.DoDomainInit() at System.DirectoryServices.AccountManagement.PrincipalContext.Initialize() at System.DirectoryServices.AccountManagement.PrincipalContext.get_QueryCtx() at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithTypeHelper(PrincipalContext context, Type principalType, Nullable`1 identityType, String identityValue, DateTime refDate) at System.DirectoryServices.AccountManagement.Principal.FindByIdentityWithType(PrincipalContext context, Type principalType, String identityValue) at System.DirectoryServices.AccountManagement.GroupPrincipal.FindByIdentity(PrincipalContext context, String identityValue) at Ceoimage.Basecamp.ActiveDirectory.SidSource._TryGetGroupPrincipal(PrincipalContext context, String groupName) in c:\Users\David\Documents\VsProjects\CeoTrunk\Ceoimage.Basecamp\Basecamp\ActiveDirectory\SidSource.cs:line 115

-- INNER EXCEPTION --

TYPE: System.DirectoryServices.DirectoryServicesCOMException

MSG: An operations error occurred.

at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_SchemaEntry() at System.DirectoryServices.AccountManagement.ADStoreCtx.IsContainer(DirectoryEntry de) at System.DirectoryServices.AccountManagement.ADStoreCtx..ctor(DirectoryEntry ctxBase, Boolean ownCtxBase, String username, String password, ContextOptions options) at System.DirectoryServices.AccountManagement.PrincipalContext.CreateContextFromDirectoryEntry(DirectoryEntry entry) at System.DirectoryServices.AccountManagement.PrincipalContext.DoLDAPDirectoryInit()

The application's web.config file specifies <authentication mode="Windows"> and <identity impersonate="true" /> but does not use a membership provider. In IIS, the application pool runs as a domain user and the app's authentication has everything disabled except for ASP.NET Impersonation (set to Authenticated user) and Windows Authentication.

The code that causes the error just tries to get a group's SID to verify the user should access the application:

public string GetGroupSid()
{
    using (var context = new PrincipalContext("Domain", "Test", "CN=Users,DC=Test,DC=local", ContextOptions.Negotiate))
    {
        var group = _TryGetGroupPrincipal(context, "AppGroup");
        return group.Sid.Value;
    }
}
private static GroupPrincipal _TryGetGroupPrincipal(PrincipalContext context, string groupName)
{
    try
    {
        return GroupPrincipal.FindByIdentity(context, groupName);
    }
    catch (Exception e)
    {
        throw _GetUnableToFindGroupException(e, groupName);
    }
}

As I said earlier, the app works fine if the request comes from the web server but throws this error when the same domain user requests the same page from any other machine on the domain. I know about enabling Kerberos, but you can see my code specifies ContextOptions.Negotiate. I'm not an expert in this stuff, but I am expertly baffled.

You haven't tried to use the more primitive AD library, have you? This doesn't answer your question but I've run into problem using the System.DirectoryServices.AccountManagement namespace that work ok with the System.DirectoryServices.ActiveDirectory namespace. Go figure. — Jason Turan
That is what I started with, but this way seemed cleaner. I am more apt to think it is a configuration issue, something about what impersonated users can and cannot do in an ASP.NET context. Can you point to any examples using "the more primitive AD library" that allow ASP.NET to get the SID of a specific AD group? — flipdoubt

flipdoubt flipdoubt · Accepted Answer · 2011-10-14T14:46:32

Configuring the web server for delegation allowed my web app to query the SID of an AD group without error and without changing any code.

Why does DirectoryServicesCOMException occur querying Active Directory from a machine other than the web server?

1 Answers